> For the complete documentation index, see [llms.txt](https://www.iblue.team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.iblue.team/memory-forensics-1/volatility-plugins/volatility3-core-commands.md).

# Volatility3 core commands

Assuming you're given a memory sample and it's likely from a Windows host, but have minimal information. Here's how you identify basic Windows host information using volatility.

```
$ python3 vol.py -f /path/to/memory.dump windows.info
```

Sometimes volatility can output/display a lot of information, and it's not necessarily easily readable. You can use the -r (render) flag to generate output in pretty (tabulated), json, csv, and quick. More information here <https://volatility3.readthedocs.io/en/stable/volatility3.cli.text_renderer.html>

I typically export results as csv if I want to import it into a timeline, or filter it in Excel, etc.

```
$ python3 vol.py -r csv -f /path/to/memory.dump windows.info
```

Display process information

```
$ python3 vol.py -f /path/to/memory.dump windows.pslist
```

If you want to display the same process information but include highlighted parent/child processes (as a tree)

```
$ python3 vol.py -f /path/to/memory.dump windows.pstree
```

Dump executables and associated DLLs (you need the process ID/PID first)

```
$ python3 vol.py -f /path/to/memory.dump -o /output/directory/ windows.dumpfiles --pid 4628
```